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TN THE CLAIMS: 

Amended claims follow: 

1 . (Currently Amended) A method for preventing needless rescanning of objects 
comprising: 

verifying an integrity of a file system by scanning the file system resulting in at least one 
known scanned region; 

creating a database of the known scanned regions of the verified file system; and 
validating an integrity of an object in the file system against the database of known 
scanned regions^ 

wherein the verifying comprises: 

receiving a file system event from a real-time monitoring system, the file system 
event indicating that an object in the file system has been accessed: and 

flagging the database of known scanned regions to indicate which of the known 
scanned regions was occupied by the accessed objecfc 

wherein the validating utilizes the flagging . 



2. (Original) The method of claim 1 , wherein verifying the integrity of the file system 
comprises scanning the objects in the file system for a presence of viruses. 



3. (Cancelled) 

4. (Cancelled) 
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5. (Currently Amended) The method of claim [4]1, wherein the database of known scanned 
regions comprises a copy of a partition table data structure indicating an identity and a location 
of a known scanned region occupied by the object. 

6. (Original) The method of claim 5, wherein the partition table data structure includes an 
inode that contains information about the object other than name, and a directory block that 
contains the object name and a number of the inode of the object. 

7. (Original) The method of claim 6, wherein the partition table data structure includes a 
super block that contains information about the file system as a whole, and a data block that 
contains a location in the file system where the object is stored. 

8. (Original) The method of claim 7, wherein validating the integrity of an object comprises 
determining that the object does not occupy a flagged known scanned region. 

9. (Original) The method of claim 6 wherein flagging comprises indicating which of the 
inodes and directory blocks were occupied by the accessed object. 

10. (Original) The method of claim 9, wherein validating the integrity of an object comprises 
determining that the object does not occupy a flagged inode and directory block, 

1 1 . (Original) The method of claim 1 further comprising: 
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rescanning the object when the integrity of the object has not been validated; and 
bypassing rescanning the object when the integrity of the object has been validated. 

12. (Currently Amended) The method of claim [4]i, wherein the real-time monitoring system 
is a VxD program. 

13. (Currently Amended) The method of claim [4]L wherein the real-time monitoring system 
is a UNIX daemon. 

14. (Currently Amended) The method of claim [4]L wherein the real-time monitoring system 
is a network loadable module, 

15. (Currently Amended) An apparatus comprising: 

a machine-accessible medium having stored thereon executable instructions to cause a 
computer to perform: 

verifying an integrity of a file system by scanning the file system resulting in at 
least one known scanned region; 

creating a database of known scanned regions of the verified file system; and 

validating the integrity of an object in the file system against the database of 
known scanned regions; 

wherein the verifying comprises: 

receiving a file system event from a realtime monitoring system, the file system 
event indicating that an object in the file system has been accessed: and 
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flagging the database of known scanned regions to indicate which of the known 
scanned regions was occupied bv the accessed object; 
wherein the validating utilizes the flagging . 

16. (Original) The apparatus of claim 15, wherein verifying the integrity of the file system 
comprises scanning every object in the file system for the presence of viruses. 

17. (Cancelled) 

18. (Cancelled) 

19. (Currently Amended) The apparatus of claim [18115, wherein the database of known 
scanned regions comprises a copy of a partition table data structure indicating an identity and a 
location of the known scanned region occupied by the object. 

20. (Original) The apparatus of claim 19, wherein the partition table data structure includes at 
least one of an inode that contains information about the object other than flame, and a directory 
block that contains the object name and a number of the inode of the object. 

21. (Original) The apparatus of claim 19, wherein the partition table data structure includes a 
super block that contains information about the file system as a whole, and a data block that 
contains a location in the file system where the object is stored. 
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22. (Original) The apparatus of claim 15, wherein validating the integrity of an object 
comprises determining that the object does not occupy a flagged region. 

23. (Currently Amended) The apparatus of claim fl8]15, wherein flagging comprises 
indicating which of the inodes and directory blocks were occupied by the opened or changed 
object. 

24. (Original) The apparatus of claim 20, wherein the instructions for validating the integrity 
of an object comprises detennining that the object does not occupy a flagged bode and directory 
block. 

25. (Original) The apparatus of claim 15 further comprising instructions to cause a computer 
to perform: 

rescanning the object when the integrity of the object has not been validated; and 
bypassing rescanning the object when the integrity of the object has been validated. 

26. (Currently Amended) The apparatus of claim [18] 15, wherein the real-time monitoring 
system is a VxD program. 

27. (Currently Amended) The apparatus of claim [18]!5, wherein the real-time monitoring 
system is a UNIX daemon. 
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28. (Currently Amended) The apparatus of claim [18] 15, wherein the real-time monitoring 
system is a network loadable module. 

29. (Currently Amended) An integrity validator comprising: 

a verifier to verify the integrity of a file system by scanning the file system resulting in at 
least one known scanned region; 

a database of the known scanned regions of the verified file system; and 
a validator to validate the integrity of an object in the file system against the database of 
known scanned regions; 

wherein the verifyina comprises: 

receiving a file system event from a real-time monitoring system, the file system 
event indicating that an object in the file system has been accessed; and 

flagging the database of known scanned regions to indicate which of the known 
scanned regions was occupied bv the accessed object; 

wherein the validating utilizes the flagging . 

30. (Original) The device of claim 29, wherein the verifier verifies the integrity of the file 
system by scanning the objects in the file system for the presence of viruses. 

31. (Cancelled) 

32. (Cancelled) 



PAGE 10/21 * RCVD AT 9/26/2005 4:58:26 PM [Eastern Daylight Time] * SVR:llSPTO-EFXRF-6/27 * DNIS:27383Q0 * CSID:4089714660 * DURATION (mm-ss):04-22 



SEP. 26. 2005 2:1 0PM ZI LKA-KOTAB, PC 



NO. 0329 P. 11 



-8- 

33. (Currently Amended) The device of claim [32J29, wherein the database of known 
scanned regions comprises a copy of a partition table data structure indicating an identity and a 
location of a known scanned region occupied by the object. 

34. (Original) The device of claim 33, wherein the partition table data structure includes an 
inode that contains information about the object other than name, and a directory block that 
contains the object name and a number of the inode of the object. 

35. (Original) The device of claim 33, wherein the partition table data structure includes a 
super block that contains information about the file system as a whole* and a data block that 
contains a location in the file system where the object is stored. 

36. (Original) The device of claim 29, wherein the validator validates the integrity of an 
object by determining that the object does not occupy a flagged known scanned region. 

37. (Currently Amended) The device of claim K2129. wherem flagging comprises indicating 
which of the partition table data structures were occupied by the accessed object. 

38. (Original) The device of claim 34, wherein the validator validates the integrity of an 
object by determining that the object does not occupy a flagged partition table data structure. 

39. (Original) The device of claim 29, further comprising: 

an AV scanner to rescan the object when the integrity of the object has not been 
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validated, wherein rescanning is bypassed when the integrity of the object has been validated. 

40. (Currently Amended) The device of claim [32]29, wherein the real-time monitoring 
system is a VxD program. 

41 . (Currently Amended) The device of claim [32]29, wherein the real-time monitoring 
system is a UNIX daemon. 

42. (Currently Amended) The device of claim [32]29 ? wherein the real-time monitoring 
system is a network loadable module. 

43. (Currently Amended) A computer system comprising: 
a processor coupled to a system bus; 

a memory coupled to the processor through the system bus; 

a machine-accessible medium coupled to the processor through the system bus; 

an integrity process executed from the machine-accessible medium by the processor, 
wherein the integrity process causes the processor to verify the integrity of a file system resulting 
in at least one known scanned region, to create a database of known scanned regions of the 
verified file system, and to validate the integrity of an object in the file system against the 
database of known scanned regions^ 

wherein the verifying comprises: 

receiving a file system event from a real-time monitoring system, the file system 

event indicating that an object in the file system has been accessed: and 
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flagging the database of known scanned regions to indicate which of the known 
scanned regions was occupied by the accessed object: 
wherein the validating utilizes the flagging . 

44. (Original) The computer system of claim 43> wherein the system causes the processor to 
verify the integrity of the file system by scanning the objects in the file system for the presence 
of viruses. 

45. (Cancelled) 

46. (Cancelled) 

47. (Currently Amended) The computer system of claim [46\42 , wherein the database of 
known scanned regions comprises a copy of a partition table data structure indicating an identity 
and a location of a known scanned region occupied by the object 

48. (Original) The computer system of claim 47, wherein the partition table data structure 
includes an inode that contains information about the object other than name, and a directory 
block that contains the object name and a number of the inode of the object. 

49. (Original) The computer system of claim 47, wherein the partition table data structure 
includes a super block that contains information about the file system as a whole, and a data 
block that contains a location in the file system where the object is stored. 



PAGE 13/21 * RCVD AT 9/26/2005 4:58:26 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/27/ DNIS:274830|^ID:M897H660 ■ DURATION (mm-ss):04-22 



SEP. 26. 2005 2:1 0PM ZI LKA-KOTAB, PC 



NO. 0329 P. 14 



-11- 

50. (Original) The computer system of claim 43, wherein the system causes the processor to 
validate the integrity of an object by determining that the object does not occupy a flagged 
known scanned region. 

51 . (Currently Amended) The computer system of claim [46143, wherein the system causes 
the processor to flag the database of known regions to indicate which of the inodes and directory 
blocks were occupied by the opened or changed object, 

52. (Original) The computer system of claim 48, wherein the system causes the processor to 
validate the integrity of an object by determining that the object does not occupy a flagged inode 
and directory block, 

53. (Original) The computer system of claim 43, wherein the system further causes the 
processor to: 

rescan the object when the integrity of the object has not been validated; and 
bypass the rescan of the object when the integrity of the object has been validated. 

54. (Currently Amended) The computer system of claim [46J43, wherein the real-time 
monitoring system is a VxD program. 

55. (Currently Amended) The computer system of claim [46]43> wherein the real-time 
monitoring system is a UNIX daemon. 
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56. (Currently Amended) The computer system of claim [46J43, wherein the real-time 
monitoring system is a network loadable module. 
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